Getting Data In

How to extract events from simple Scripted Input stdout?

tiandrey
Engager

Hello,
I'm trying to understand Scripted Inputs concept so I have created simple Scripted Input with Python script:

import sys
sys.stdout.write('test1,test2,test3\n')

I want to add these events in the main index.
My Scripted Input lies in search app, I have added pops.conf (all configs are in the local folder of the search app):

[test]
TIME_PREFIX=^[^\|]+\|
TIME_FORMAT=%Q
SHOULD_LINEMERGE=false

Inputs.conf:

[script://$SPLUNK_HOME\bin\scripts\test.py]
disabled = 0
index = main
interval = 15
sourcetype = test

Howerer I don't see any events in my main index, also nothing in logs either. I have splunk enterprise under a local account on Windows.
Where is my mistake?

0 Karma
1 Solution

kurdbahr
Path Finder

Are there any errors in splunkd.log?
You probably need a wrapper script (.cmd) to execute the python code, because the ".py" extension may not be registered to execute python directly.

The recommended way to execute a python script from Splunk is:

$SPLUNK_HOME/bin/splunk cmd python <your_script>.py

http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptWriting

View solution in original post

kurdbahr
Path Finder

Are there any errors in splunkd.log?
You probably need a wrapper script (.cmd) to execute the python code, because the ".py" extension may not be registered to execute python directly.

The recommended way to execute a python script from Splunk is:

$SPLUNK_HOME/bin/splunk cmd python <your_script>.py

http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptWriting

tiandrey
Engager

In splunkd.log I can see:
06-06-2015 15:41:37.321 -0400 INFO ExecProcessor - New scheduled exec process: python /opt/splunk/bin/scripts/test.py

The script is working, I have checked it (it created log file etc) however no events

0 Karma

tiandrey
Engager

It seems I have solved the problem. My output was in wrong format. This format works:
print "%s eventID=%s" % ("[" + strftime("%m/%d/%Y %H:%M:%S %p %Z",localtime()) + "]", int(time.time()))
But I have another question, how to make splunk read my custom formated event?

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...